Riskcovery

CVE-2026-47981

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

State
Published
Severity
5.4 Medium
Published
Jun 9, 2026
Updated
Aug 27, 2026
Reserved
May 20, 2026

Read the record on cve.org

Description

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

Scores

CVSSScoreVectorSource
3.15.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:Nadobe

Weaknesses

  • CWE-79 Cross-site Scripting (Stored XSS) (CWE-79)

Affected Products

ProductVersions
Adobe Experience Manager as a Cloud ServiceAdobe
  • 2026.4.0 and earlierAffected
  • 2026.5.0Not affected
Adobe Experience Manager 6.5 LTSAdobe
  • SP1 and earlierAffected
  • SP2Not affected
Adobe Experience Manager 6.5Adobe
  • 6.5.24 and earlierAffected
  • 6.5.25Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.